Skip to content
Snippets Groups Projects
  • Alex Klyubin's avatar
    9a14704f
    Wifi Keystore HAL is not a HAL · 9a14704f
    Alex Klyubin authored
    Wifi Keystore HAL is a HwBinder service (currently offered by keystore
    daemon) which is used by Wifi Supplicant HAL. This commit thus
    switches the SELinux policy of Wifi Keystore HAL to the approach used
    for non-HAL HwBinder services.
    
    The basic idea is simimilar to how we express Binder services in the
    policy, with two tweaks: (1) we don't have 'hwservicemanager find' and
    thus there's no add_hwservice macro, and (2) we need loosen the
    coupling between core and vendor components. For example, it should be
    possible to move a HwBinder service offered by a core component into
    another core component, without having to update the SELinux policy of
    the vendor image. We thus annotate all components offering HwBinder
    service x across the core-vendor boundary with x_server, which enables
    the policy of clients to contain rules of the form:
    binder_call(mydomain, x_server), and, if the service uses IPC
    callbacks, also binder_call(x_server, mydomain).
    
    Test: mmm system/sepolicy
    Test: sesearch indicates to changes to binder { call transfer} between
          keystore and hal_wifi_supplicant_default domains
    Bug: 36896667
    
    Change-Id: I45c4ce8159b63869d7bb6df5c812c5291776d892
    9a14704f
    History
    Wifi Keystore HAL is not a HAL
    Alex Klyubin authored
    Wifi Keystore HAL is a HwBinder service (currently offered by keystore
    daemon) which is used by Wifi Supplicant HAL. This commit thus
    switches the SELinux policy of Wifi Keystore HAL to the approach used
    for non-HAL HwBinder services.
    
    The basic idea is simimilar to how we express Binder services in the
    policy, with two tweaks: (1) we don't have 'hwservicemanager find' and
    thus there's no add_hwservice macro, and (2) we need loosen the
    coupling between core and vendor components. For example, it should be
    possible to move a HwBinder service offered by a core component into
    another core component, without having to update the SELinux policy of
    the vendor image. We thus annotate all components offering HwBinder
    service x across the core-vendor boundary with x_server, which enables
    the policy of clients to contain rules of the form:
    binder_call(mydomain, x_server), and, if the service uses IPC
    callbacks, also binder_call(x_server, mydomain).
    
    Test: mmm system/sepolicy
    Test: sesearch indicates to changes to binder { call transfer} between
          keystore and hal_wifi_supplicant_default domains
    Bug: 36896667
    
    Change-Id: I45c4ce8159b63869d7bb6df5c812c5291776d892